KwtyZ0Vt

1
2* ID: 2325
3* MalFamily: ""
4
5* MalScore: 10.0
6
7* File Name: "AgentTesla_351eb287618799d48f4bdb3225c94029.exe"
8* File Size: 614400
9* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
10* SHA256: "b9e355d367b2d26a2f1f558e1b4e77ac351e2e9b9a7a4bb81acdf104c692b2c2"
11* MD5: "351eb287618799d48f4bdb3225c94029"
12* SHA1: "1594df98665618c97e05be9d3f8545d4a9f19214"
13* SHA512: "8e9b38ef86b0b32147287ef5dcf0a47f7a3a3063f988cf564f39ec0ad708d3ac62b81ba9922dfaab0c67f403127012e9206d7b4f1ca366c7204e52ce023c090a"
14* CRC32: "EE5E5E5F"
15* SSDEEP: "12288:NKx4Jj666+dnSqTGt0a10OCNlKDpOVpeYaQX:No4JJ6+pSqTGt0o5CXAQVbaY"
16
17* Process Execution: 
18    "Z6GFKMl5eW.exe",
19    "Z6GFKMl5eW.exe",
20    "services.exe",
21    "svchost.exe",
22    "WmiPrvSE.exe",
23    "svchost.exe",
24    "lsass.exe"
25
26
27* Executed Commands: 
28    "\"C:\\Users\\user\\AppData\\Local\\Temp\\Z6GFKMl5eW.exe\"",
29    "C:\\Windows\\system32\\lsass.exe"
30
31
32* Signatures Detected: 
33    
34        "Description": "Behavioural detection: Executable code extraction",
35        "Details": 
36    
37    
38        "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
39        "Details": 
40    
41    
42        "Description": "Guard pages use detected - possible anti-debugging.",
43        "Details": 
44    
45    
46        "Description": "The binary likely contains encrypted or compressed data.",
47        "Details": 
48            
49                "section": "name: .text, entropy: 7.19, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00093000, virtual_size: 0x00092278"
50            
51        
52    
53    
54        "Description": "Behavioural detection: Injection (Process Hollowing)",
55        "Details": 
56            
57                "Injection": "Z6GFKMl5eW.exe(2432) -> Z6GFKMl5eW.exe(2568)"
58            
59        
60    
61    
62        "Description": "Executed a process and injected code into it, probably while unpacking",
63        "Details": 
64            
65                "Injection": "Z6GFKMl5eW.exe(2432) -> Z6GFKMl5eW.exe(2568)"
66            
67        
68    
69    
70        "Description": "Sniffs keystrokes",
71        "Details": 
72            
73                "SetWindowsHookExW": "Process: Z6GFKMl5eW.exe(2568)"
74            
75        
76    
77    
78        "Description": "A process attempted to delay the analysis task by a long amount of time.",
79        "Details": 
80            
81                "Process": "Z6GFKMl5eW.exe tried to sleep 4152 seconds, actually delayed analysis time by 0 seconds"
82            
83            
84                "Process": "WmiPrvSE.exe tried to sleep 423 seconds, actually delayed analysis time by 0 seconds"
85            
86        
87    
88    
89        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
90        "Details": 
91            
92                "Spam": "Z6GFKMl5eW.exe (2568) called API NtYieldExecution 10615 times"
93            
94        
95    
96    
97        "Description": "Steals private information from local Internet browsers",
98        "Details": 
99            
100                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
101            
102        
103    
104    
105        "Description": "Stack pivoting was detected when using a critical API",
106        "Details": 
107            
108                "process": "svchost.exe:2356"
109            
110        
111    
112    
113        "Description": "File has been identified by 41 Antiviruses on VirusTotal as malicious",
114        "Details": 
115            
116                "MicroWorld-eScan": "Gen:Variant.Midie.66301"
117            
118            
119                "McAfee": "Fareit-FPZ!351EB2876187"
120            
121            
122                "Malwarebytes": "Trojan.MalPack.VB.Generic"
123            
124            
125                "Cybereason": "malicious.866561"
126            
127            
128                "Arcabit": "Trojan.Midie.D102FD"
129            
130            
131                "TrendMicro": "TROJ_GEN.R015C0DII19"
132            
133            
134                "F-Prot": "W32/VBKrypt.SQ.gen!Eldorado"
135            
136            
137                "Symantec": "ML.Attribute.HighConfidence"
138            
139            
140                "APEX": "Malicious"
141            
142            
143                "Paloalto": "generic.ml"
144            
145            
146                "Kaspersky": "Trojan.Win32.VBKryjetor.chax"
147            
148            
149                "BitDefender": "Gen:Variant.Midie.66301"
150            
151            
152                "Avast": "Win32:TrojanX-gen Trj"
153            
154            
155                "Rising": "Trojan.Injector!1.B459 (CLASSIC)"
156            
157            
158                "Ad-Aware": "Gen:Variant.Midie.66301"
159            
160            
161                "Sophos": "Mal/FareitVB-N"
162            
163            
164                "F-Secure": "Trojan.TR/Kryptik.hfzvw"
165            
166            
167                "DrWeb": "Trojan.PWS.Banker1.34969"
168            
169            
170                "Invincea": "heuristic"
171            
172            
173                "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.jc"
174            
175            
176                "Trapmine": "malicious.moderate.ml.score"
177            
178            
179                "FireEye": "Generic.mg.351eb287618799d4"
180            
181            
182                "Emsisoft": "Gen:Variant.Midie.66301 (B)"
183            
184            
185                "Ikarus": "Trojan.VB.Agent"
186            
187            
188                "Cyren": "W32/VBKrypt.SQ.gen!Eldorado"
189            
190            
191                "Avira": "TR/Kryptik.hfzvw"
192            
193            
194                "MAX": "malware (ai score=85)"
195            
196            
197                "Microsoft": "Trojan:Win32/Vbobfus.A!eml"
198            
199            
200                "Endgame": "malicious (high confidence)"
201            
202            
203                "ZoneAlarm": "Trojan.Win32.VBKryjetor.chax"
204            
205            
206                "GData": "Gen:Variant.Midie.66301"
207            
208            
209                "AhnLab-V3": "Win-Trojan/VBKrypt.RP12"
210            
211            
212                "Acronis": "suspicious"
213            
214            
215                "ALYac": "Gen:Variant.Midie.66301"
216            
217            
218                "Cylance": "Unsafe"
219            
220            
221                "ESET-NOD32": "a variant of Win32/Injector.EHVD"
222            
223            
224                "SentinelOne": "DFI - Suspicious PE"
225            
226            
227                "Fortinet": "W32/GenKryptik.EHBD!tr"
228            
229            
230                "AVG": "Win32:TrojanX-gen Trj"
231            
232            
233                "Panda": "Trj/GdSda.A"
234            
235            
236                "CrowdStrike": "win/malicious_confidence_100% (W)"
237            
238        
239    
240    
241        "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
242        "Details": 
243    
244    
245        "Description": "Harvests credentials from local FTP client softwares",
246        "Details": 
247            
248                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
249            
250            
251                "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\"
252            
253            
254                "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml"
255            
256            
257                "file": "C:\\Users\\user\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini"
258            
259            
260                "file": "C:\\cftp\\Ftplist.txt"
261            
262            
263                "key": "HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites"
264            
265        
266    
267    
268        "Description": "Harvests information related to installed mail clients",
269        "Details": 
270            
271                "file": "C:\\Users\\user\\AppData\\Roaming\\Thunderbird\\profiles.ini"
272            
273            
274                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
275            
276            
277                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
278            
279            
280                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
281            
282            
283                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
284            
285            
286                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
287            
288            
289                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
290            
291            
292                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
293            
294            
295                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
296            
297            
298                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
299            
300            
301                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
302            
303            
304                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
305            
306            
307                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
308            
309            
310                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
311            
312            
313                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
314            
315            
316                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
317            
318            
319                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
320            
321        
322    
323    
324        "Description": "Collects information to fingerprint the system",
325        "Details": 
326    
327
328
329* Started Service: 
330    "VaultSvc"
331
332
333* Mutexes: 
334    "Global\\CLR_PerfMon_WrapMutex",
335    "Global\\CLR_CASOFF_MUTEX",
336    "Local\\_!MSFTHISTORY!_",
337    "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
338    "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
339    "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
340    "Global\\.net clr networking"
341
342
343* Modified Files: 
344    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
345    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
346    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
347    "C:\\Users\\user\\AppData\\Roaming\\H3yciH7mXi.jpeg",
348    "C:\\Users\\user\\AppData\\Roaming\\It0HEdTzys.jpeg",
349    "C:\\Users\\user\\AppData\\Roaming\\VMmdF7F8Ud.jpeg",
350    "C:\\Users\\user\\AppData\\Roaming\\IrY15T51f8.jpeg",
351    "C:\\Users\\user\\AppData\\Roaming\\GWCkYYf8HY.jpeg",
352    "\\??\\PIPE\\samr",
353    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
354    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
355    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
356    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
357    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
358    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
359    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
360    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
361    "\\??\\WMIDataDevice",
362    "\\??\\PIPE\\wkssvc",
363    "\\??\\PIPE\\srvsvc"
364
365
366* Deleted Files: 
367    "C:\\Users\\user\\AppData\\Roaming\\IrY15T51f8.jpeg",
368    "C:\\Users\\user\\AppData\\Roaming\\GWCkYYf8HY.jpeg"
369
370
371* Modified Registry Keys: 
372    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\Z6GFKMl5eW_RASAPI32",
373    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Z6GFKMl5eW_RASAPI32\\EnableFileTracing",
374    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Z6GFKMl5eW_RASAPI32\\EnableConsoleTracing",
375    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Z6GFKMl5eW_RASAPI32\\FileTracingMask",
376    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Z6GFKMl5eW_RASAPI32\\ConsoleTracingMask",
377    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Z6GFKMl5eW_RASAPI32\\MaxFileSize",
378    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Z6GFKMl5eW_RASAPI32\\FileDirectory",
379    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
380    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
381    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
382    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
383    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
384    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
385    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
386    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
387
388
389* Deleted Registry Keys: 
390
391* DNS Communications: 
392    
393        "type": "A",
394        "request": "checkip.amazonaws.com",
395        "answers": 
396    
397    
398        "type": "A",
399        "request": "mail.omrussiatours.com",
400        "answers": 
401    
402
403
404* Domains: 
405    
406        "ip": "52.55.255.113",
407        "domain": "checkip.amazonaws.com"
408    
409    
410        "ip": "209.99.16.234",
411        "domain": "mail.omrussiatours.com"
412    
413
414
415* Network Communication - ICMP: 
416
417* Network Communication - HTTP: 
418
419* Network Communication - SMTP: 
420
421* Network Communication - Hosts: 
422
423* Network Communication - IRC: